All of the release distribution packages have been digitally
signed (using PGP or GPG) by the ASF committers that constructed
them. There will be an accompanying
distribution.asc file in the same directory
as the distribution. The PGP/GPG keys can be found at the MIT key
repository and within this project's KEYS file at http://www.apache.org/dist/commons/KEYS.